1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
name: Release slickit
on:
push:
tags:
workflow_dispatch:
inputs:
dry-run:
description: "Dry run (skip actual publish)"
type: boolean
default: false
permissions:
contents: read
jobs:
# ── Test before publishing ────────────────────────────────────────
test:
name: Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
- name: Run tests
run: cargo test --all-features
- name: Clippy
run: cargo clippy --all-features -- -D warnings
# ── Publish to crates.io ──────────────────────────────────────────
crates:
name: Publish to crates.io
needs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
- name: Publish slickit
if: ${{ !inputs.dry-run }}
run: cargo publish --all-features || echo "Already published (idempotent)"
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
- name: Dry run
if: ${{ inputs.dry-run }}
run: cargo publish --all-features --dry-run
# ── Build Python wheels for each platform ─────────────────────────
build:
name: Build wheels (${{ matrix.target }})
needs:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
include:
# macOS
- os: macos-latest
target: aarch64-apple-darwin
- os: macos-latest
target: x86_64-apple-darwin
# Linux
- os: ubuntu-latest
target: x86_64-unknown-linux-gnu
- os: ubuntu-latest
target: aarch64-unknown-linux-gnu
# Windows
- os: windows-latest
target: x86_64-pc-windows-msvc
steps:
- uses: actions/checkout@v4
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Build wheel
uses: PyO3/maturin-action@v1
with:
target: ${{ matrix.target }}
args: --release --out dist -i python3.12
manylinux: auto
working-directory: crusts/python
- name: Upload wheel
uses: actions/upload-artifact@v4
with:
name: wheel-${{ matrix.target }}
path: crusts/python/dist/*.whl
# ── Build sdist ───────────────────────────────────────────────────
sdist:
name: Build sdist
needs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Build sdist
uses: PyO3/maturin-action@v1
with:
command: sdist
args: --out dist
working-directory: crusts/python
- name: Upload sdist
uses: actions/upload-artifact@v4
with:
name: sdist
path: crusts/python/dist/*.tar.gz
# ── Publish to PyPI ───────────────────────────────────────────────
pypi:
name: Publish to PyPI
needs:
runs-on: ubuntu-latest
permissions:
id-token: write # trusted publisher OIDC
steps:
- name: Download all artifacts
uses: actions/download-artifact@v4
with:
path: dist
merge-multiple: true
- name: List artifacts
run: ls -la dist/
- name: Publish to PyPI
if: ${{ !inputs.dry-run }}
uses: pypa/gh-action-pypi-publish@release/v1
with:
packages-dir: dist/
- name: Dry run
if: ${{ inputs.dry-run }}
run: echo "Dry run — skipping PyPI publish"
# ── Build and publish to npm ──────────────────────────────────────
# Disabled: npm 2FA/org setup blocking publish. Re-enable when sorted.
# npm:
# name: Publish to npm
# needs: [test]
# runs-on: ubuntu-latest
# permissions:
# contents: read
# id-token: write
# steps:
# - uses: actions/checkout@v4
# - uses: dtolnay/rust-toolchain@stable
# - run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
# - run: wasm-pack build --target web
# working-directory: crusts/wasm
# - working-directory: crusts/wasm/pkg
# run: jq '.name = "slickit"' package.json > tmp.json && mv tmp.json package.json
# - uses: actions/setup-node@v4
# with:
# node-version: "22"
# registry-url: "https://registry.npmjs.org"
# - if: ${{ !inputs.dry-run }}
# run: npm publish --access public --provenance
# working-directory: crusts/wasm/pkg
# env:
# NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}